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Introduction 

NASA-JSC is very focused on human-rated space safety. 

Stringent safety reviews are held or led by Center personnel 
to assure a safe human-rated space environment for our 
space missions. 

Human-rated safety requires two-fault tolerance to all 
catastrophic failures, and one-fault tolerance to all critical 
failures. 
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Hazard Basics 


In summary, hazards are based on two factors: 

Energy : can cause personnel injury and damage to equipment 
due to high temperatures, fire or explosions 

Toxicity : Can range from being a mild irritant to being lethal 

- Tox 0 is non-critical failure 

- Tox 1 is critical failure 

- Tox 2 and above is catastrophic 

- Tox 4 - may not allowed in crewed environment in the near future 

(Need to consult tox group for assessment) 

- Top Level Requirement is Two-fault tolerance to all 
catastrophic failures. 
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Hazards 

Electrical / Mechanical / Environmental: 

• Can cause Venting, Fire, Explosion, Thermal runaway 

Energy Content of some materials used in the Shuttle: 

> Hydrazine - Shuttle APU- 1291 Btu/lb; TNT: 1929 Btu/lb; LiSOCI 2 /LiBCX: 2000 Btu/lb 

> Water: KOH electrolyte is 30 -45 % weight in water. KOH used in alkaline, NiCd, NiMH, Ag-Zn, etc. 
If electrolyzed by overcharge or overdischarge, it yields a H 2 /0 2 mixture that has an equivalent of 
5783 Btu/lb (Oxygen is non-flammable but supports and vigorously accelerates combustion of 
flammables; hydrogen is in itself a fuel). 


Toxicity: 

- Aqueous electrolyte : Typically a max of tox 2 

- cone. Potassium hydroxide - Alkaline, silver zinc (Ag-Zn), Nickel 
metal hydride (NiMH), Nickel cadmium (NiCd), Nickel hydrogen (Ni- 

H 2 ) 

- Cone. Sulfuric acid - Lead acid 

- Organic Electrolyte: Typically a max of tox 2 

- Mixture of organic carbonates and ethers or esters with an inorganic 
salt to provide ionic conductivity - Lithium primary batteries such as 
Lithium manganese dioxide (LiMn0 2 ), Lithium polycarbon 
monofluoride [Li(CF) x j, Lithium irondisulfide (LiFeS 2 ) 

- Inorganic Electrolyte: Typically tox 4 

- Thionyl chloride, sulfuryl chloride, Bromine chloride complex, sulfur 
dioxide - Lithium thionyl chloride (LiSOCI 2 ), LiBCX, Lithium sulfuryl 
chloride (LiS0 2 CI 2 ), Lithium sulfur dioxide (LiS0 2 ) 

- These also have a TNT equivalency ( a pound of these lithium cells 
explodes with an energy equivalent to a pound of JNT) 

5 


J. Jeevarajan, Ph.D. / NASA-JSC 


Two-fault Tolerance 


Most hazards can be protected by two-fault tolerance 
except for internal shorts that are caused by 
manufacturing defects 

• In the case of internal short hazards, DFMR is typically used 

• Cell / battery screening can be carried out using X-rays, CT scans, 
vibration to higher levels, self discharge tests, etc. 

Fault tolerance should be verified at the appropriate 
level. 

• For example, if a cell internal protective device is used as a 
level of control, then it should be verified, by testing, that this 
control is valid at the battery level and that the device still 
provides the same extent of protection at the battery level. 
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Safety Requirements Documents 


JSC 20793, Rev B “Crewed Space Vehicle Battery Safety 
Requirements” is the top-level reference for battery safety 
requirements. 

Payload Safety Requirements: NSTS 1700.7B Section 200.1b - 
Safety Policy and Requirements for Payloads using the STS 

Space Station Safety Requirements: SSP 50021 Section 
3. 3. 6.1 .1 - Safety Requirements Document for ISS 

SSP 50094 Joint Russian and US requirements for ISS 

Space Shuttle Safety Requirements: NSTS 22254 Section 1.6 - 
Methodology for Conduct of Space Shuttle Program Hazard 
Analyses and Section 1 D201 .6 of NHB 5300.4 (1 D-2) - Safety, 
Reliability, Maintainability and Quality Provisions for the SSP. 

Space Station/Shuttle Safety Requirements: JSC 28484 Section 
3.3.6 - Program Requirements Document for JSC Non-critical 


GFE. 


Russian Requirements Document: P32928-103 
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Battery Requirements Documents 

Two battery requirements documents: 

- JSC 20793 RevB Crewed Space Vehicle Battery 
Requirements (Rev B is in signature cycle) 

- (old Manned Space Vehicle Battery Handbook) 

- and 

- EA-CWI-033 Battery Processing (in the process of 
being converted from CWI to JWI document) 

- Currently both are found on the Internal JSC - EA 
website 

- Export Control clearance obtained for public 
access 
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Battery Flight Certification Process 
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Process for a New Lot of Certified Batteries 





New Lot / Batch 
of Batteries 






T , c 1 T Flight Test 

^""3 to 6 % of every tot ( 1 00 % of flight batteries) 




Verify qualification tests and 
Some abuse tests on batteries and cells 
(Tests that are critical especially 
those that are considered to be 
safety controls 
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Non-COTS Battery Certification Process 
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Examples of Stringent Testing for Safe Design of 
Li-ion Batteries for Human-rated Missions 

In the past decade, NASA-JSC battery group has carried out 
several tests on the safety of li-ion cells, modules and battery 
packs 

The hazards associated with using commercial li-ion cells in 
high voltage and high capacity batteries have been 
determined to be different from those associated with the use 
of the same cells in low voltage, low capacity packs (less 
than 15 V and 60 Wh) 

Tests carried out included overcharge, overdischarge, 
external and internal short circuits with destructive physical 
analysis included in most cases. 

- Chemical analysis, X-rays and in some cases CT scans were used for 
post-test analysis 
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Outline 


• Limitations of internal protective devices such as the PTC 
and CID in 18650 li-ion cells 

• Safety of the 18650 li-ion cells in a vacuum environment 

• Overdischarge test results for 18650 li-ion cell modules 

• Safety of Matrix pack design for 18650 li-ion cells 

• Internal short hazards in li-ion cells 

Data and information for these topics has been presented at 
earlier conferences and the references will be presented 
under each section 


J. Jeevarajan, Ph.D. / NASA-JSC 


13 


Background 

Lithium-ion cells, whether cylindrical, prismatic, elliptical, etc. have different forms 
of internal protective devices 


- PTC 

- CID 


- Tab/lead meltdown (fusible link type) 

- Bimetallic disconnects 

- etc. 


CID 


Top disc 



Bottom disc 


Tab 


External protective devices used in 
lithium-ion battery designs are 

- Diodes 

- PTC/polyswitch 

- Thermal fuses (hard blow or resettable) 

- Circuit boards with specialized wire traces 

- etc. 



Manufacturing quality will be discussed with respect to internal short hazards - 
cell quality as well as uniformity of cell performance is very critical 
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Limitations of Internal Protective Devices in 18650 Li-ion 

Cells 
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Limitations of Internal Protective Devices in 18650 Li-ion 

Cells 

(Data presented at Power Sources 2008) 

Test programs in the past decade indicated that internal protective 
devices (such as the PTC and CID) in small cylindrical COTS 
(commercial-off-the-shelf) Li-ion cells failed to protect when the battery 
module designs included multi-cell series and/or parallel configurations. 
However, a definite set of tests were not carried out to characterize these 
limitations. 


In this test program, the tests were carried out with cells in series and/or 
cells in parallel 

The tests carried out were off-nominal and were carried out under worst- 
case conditions to determine the worst-case failures that could occur. 

Cells used for these test programs were only test vehicles to provide data 
for the issue being discussed and also due to ease of availability. The 
test results do not infer any type of endorsement and are presented for 
information purposes only. 
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Schematic of Cell Header Portion 
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External Short and Overcharge on Single 18650 Li- 

ion Cells (low voltage) 


N2-360-1 A, Samples 1 and 2, 50mOhm SC, 18Oct07 
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Time (ms) 
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1200 



Peak 

Current (A) 

Peak Temp 

r c) 

N2-360-1A-1 

37 

78 

N2-360-1A-2 

30 

82 


Operation consistent with typical 
18650 cell PTC performance 


N2-360-2A-11, 12V 1.5A Overcharge. Single Cell. 19Oct07 


-VI — II — Tend — Tmid 



0 : 47:31 0 : 50:24 0 : 53:17 0 : 56:10 0 : 59:02 1 : 01:55 1 : 04:48 1 : 07:41 

TimeinTest 



Sample Temp, at 
CID Open (° C) 

N2-360-2A-11 

59 

N2-360-2A-12 

73 


CID devices activated in both samples at 
1 hour and 2 minutes into the overcharge. 
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Overcharge Test on a 14-Cell String Showing Cell Voltages 

for the 18650 Li-ion Cells (High voltage) 
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Cells missing from 14-cell string on test table after test event : 27, 28, 30 and 31 


Cells 37, 38 and 45 showed no visible 
Signs of venting 
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Overcharge Test on 14S set of 18650 Lithium-ion Cells 

(contd.) 
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Voltage (V) 


14-Cell String Short Circuit Test on 18650 Li-ion Cells (High 

Voltage) 
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Only venting observed, 
no fire 

Cell Voltages in bold - 
No visible signs of 
Venting or damage, 
but no voltage; 

All others vented with 
Obvious leakage or 
discoloration 



Rapid cell venting within the first 10 seconds 
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Variable Bank (High Capacity) Size Test Summary Table 


Test Code 

Date 

Old Cells 

New Cells 

Description 

Volts 

Amps 

1A 

1 8-Oct 

2 


Single cell short, 2X 



2A 

1 9-Oct 

2 


Single cell overcharge, 2X 

12 

6 

4A 

26-Oct 

4 


4P overcharge, 48V, 6A 

48 

6 

4A2 

24-Oct 

4 


4P overcharge, 12V, 6A 

12 

6 

4A3 

31 -Oct 

4 


4P overcharge, 12V, 4A 

12 

4 

4A4 

1-Nov 


4 

4P overcharge, 12V, 6A 

12 

6 

4B 

2-Nov 


16 

16P overcharge, 48V, 24A 

48 

24 

4A5 

15-Nov 

4 


4P overcharge, 12V, 6A 

12 

6 

4B2 

19-Nov 


16 

16P overcharge, 12V, 24A 

12 

24 

4B3 

19-Dec 


16 

16P overcharge, 12V, 12A 

12 

12 

3B 

31 -Jan 


16 

16P short circuit 




• Test 1A- 50mOhm Short Circuit on Single Cells 

• Test 2A- 12V, 1 .5A Overcharge on Single Cells 

• Test 4A- Overcharge on 4 parallel cells 

• Test 4B- Overcharge on 16 parallel cells 

• Test 3B- Short Circuit on 16 parallel connected cell battery 
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Overcharge Tests on 4P 18650 Li-ion Module (High Capacity) 


N2-360-B-4A-43, 4P Battery, 48V, 6A Overcharge, 26Oct07 


1 :Shnt1 CHI 1:Shnt2CH2 1:Shnt3CH3 1:Shnt4CH4 1:Shnt5CH5 

1 :T1 Ch8 1 :T2 ChIO 1:T3Ch14 1:T4Ch15 ---- 1:BatVCH6 



Time in Test 


Test 4A- 48V 6A Overcharge on 4P Battery 


*The current on cell 4 in the 
parallel battery dropped low 
at ~1 hour into the 
overcharge; 14 minutes later 
the three other cells began to 
trip CID devices (a pop was 
audible) in sequence 
•When the 3 cells dropped 
out, cell 4 was left carrying 
the 6A charge current. 

•Cell 4 ruptured with flame 
(explosion); The cell can was 
split; temperature of the cell 
at the time of the event was 
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High Voltage/High Capacity Limitation Studies - Summary Of Tests and 

Results 

Load Notes 

Description Volts Amps (Ohms) 

CID operates; Canon / 

Single cell overcharge, 2X 12 L5 fresh 

Thermal runaway; 

4P overcharge, 48V, 6A 48 6 Canon 

4P overcharge, 12V, 6A 12 6 CID operates; fresh 

j Thermal runaway / 

4P overcharge, 12V, 6 A 12 6 Canon 

4P overcharge, 12V, 4A 12 4 CID operates / Canon 

16P overcharge, 48V, 24 A 48 24 Thermal runaway / fresh 

16P overcharge, 12V, 24 A 12 24 Thermal runaway / fresh 

16P overcharge, 12V, 12A 12 12 CID operates /fresh 

2 No thermal runaway 

1 6 P external short /Canon 

No failures; PTC trips / 

Single Cell external shorts Canon 

50 No failures; PTC trips / 

4S External short Canon 

50 PTC fails; venting and 

14S External short sparks / Canon 

No failure; CID activates 

4S Overcharge 48 L5 / Canon 

Thermal runaway / 

14S Overcharge 84 L5 Canon 
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Limitations of Internal Protective Devices in 18650 Li-ion Cells 

Summary 

The PTC characteristics varies from manufacturer to manufacturer in their trip 
currents as well as withstanding voltages. The withstanding voltage of the PTCs 
implies that they have a voltage limitation. 

Tripping cell PTCs irreversibly increases their electrical resistance by up to a 
factor of two. Compromised or high-resistance PTCs cause catastrophic failures 
under overcharge conditions. 

The CID did not protect or underwent incomplete opening and reset under some 
overcharge conditions. 

- Cell internal heating causing separator damage, PTC ignition before CID opening, etc. 

In cell banks, two major factors dictated the reaction of the cells to overcharge 
conditions. These were the charge current and voltage of the cell string or 
voltage limit set on the equipment. For example, 16 cells in parallel went into a 
thermal runaway under 48 V, 24A conditions as well as 12V 24A conditions. But 
they did not go into a thermal runaway under 12 V, 12 A test condition. 

The complete data set can be obtained from the presentation at the Power 
Sources 2008. 
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Overcharge and External Short Tests for High Voltage 
18650 Cell Strings under Vacuum Conditions 
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Overcharge and External Short Tests for High Voltage 18650 Cell 

Strings under Vacuum Conditions 
(Data presented at NASA Battery Workshop 2008) 


Li-ion batteries are used in various environments in space 
including vacuum 

It is important to determine the safety of the high voltage li- 
ion cell modules in a vacuum environment under conditions 
of overcharge and external short circuit to help design the 
modules safely 

A summary of the results from this test program will be 
presented here 

For more details, refer to paper presented at NASA Battery 
Workshop 2008 
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External Short under Vacuum Conditions 
(High Voltage 14S string) 
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Overcharge Test on High Voltage Li-ion Cell String (14S) 
and High Capacity Bank (16P) Under Vacuum Condition 
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Overcharge and External Short Tests for High Voltage 
18650 Cell Strings under Vacuum Conditions 

Summary 

Under Vacuum conditions, the external short test caused thermal runaway in all 
the 14S (14 series) cells, but the overcharge condition in the series and parallel 
configurations did not result in a thermal runaway. 

- These results are the opposite of that seen at ambient pressure environments 

It is critical to test under the relevant environment to understand the worst case 
hazards encountered with the high voltage strings 
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Overdischarge Test Program on 18650 Li-ion Modules 
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Overdischarge Test Program on 18650 Li-ion Modules 

(Power Sources 2010) 

Lithium-ion cells of the cylindrical commercial-off-the-shelf 18650 design format 
were used to study the hazards associated with overdischarge. 

The cells in series or in parallel configurations were subjected to different 
conditions of overdischarge. 

The cells in parallel configurations were all overdischarged to 2.0 V for 75 cycles 
with one cell removed at 25 cycles to study the health of the cell. 

The cells in series were designed to be in an unbalanced configuration by 
discharging one cell in each series configuration before the start of test. The 
discharge consisted of removing a pre-determined capacity from the cell. This 
ranged from 50 to 150 mAh removal. The cells were discharged down to a 
predetermined end-of-discharge voltage cutoff which allowed the cell with lower 
capacity to go into an overdischarge mode. 

The cell modules that survived the 75 cycles were subjected to one overvoltage 
test to 4.4 V/cell 





Single Cell Cycling with Continuous Deep 

Discharge 



Charge: C/2 to 4.2 V; Discharge: C/2 to 2.0 V 
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Temperature (deg. C) 




Voltage (V) 


Cycle Life Test for a 6P Lithium-ion Module with 

Continuous Overdischarge 
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Charge: C/2 (1.08 A); EOCV: 4.2 V 
Discharge: C/2 A; EODV: 2.0 V 
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Voltage (V) 


Overdischarge Test on 10S Unbalanced Cell 
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Temperature (deg. C) 




Voltage (V) Cell Voltage (V) & Current (A) 


Overdischarge Test on 10S Unbalanced Cell Module 
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Cell Voltage (V) 




Overdischarge Test Program 

Summary 


The single cells as well as the cells in parallel design configurations did not 
display any anomalous behavior. There was a very slight increase in resistance 
with the deep discharges (EODV is 2.0 V) that they were subjected to. 

The series configuration test modules with the unbalanced cells displayed 
different behavior. If the capacity removed from the unbalanced cell was 100 
mAh or greater (50 mV or greater imbalance), the cells did show internal shorting 
at some point and this caused instability in the whole string or abnormal behavior 
in some. 

If the imbalance in the cell strings was in the range of 50 mAh or less, no 
significant changes in cycling behavior were observed even though the 
imbalanced cell went to very low voltages (less than 1 .0 V) throughout the 
program. 
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Matrix Design Safety for Li-ion Cell Modules 
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Matrix Design Safety for Li-ion Cell Modules 

(Space Power 2010) 

Commercial lithium-ion batteries in portable electronic equipment have 
been used by NASA for space applications since 1999. 

Latest Lenovo Thinkpad Battery has cells in a matrix configuration. 

Used Quallion matrix packs to understand the performance as well as 
safety 

Test Articles: 

- Two 5X5 Matrix Packs (One with Heat Absorbent Material (HAM) and one without) 

- One 8X8 Matrix Pack (without HAM) 

Cells are from Sanyo (cobaltate in the 8X8 and spinels in the 5X5) 

Tests: 




Short term cycle life: 100 cycles (all three packs) 
Additional 100 cycles with one cell disconnected (5X5 
Overcharge Test : 5X5 packs 
External Short: 8X8 pack 
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Overcharge Test for 5X5 Matrix Pack (no HAM) 

(Overcharge at 10 A) 



Bank 1 behaves like a soft-shorted bank; 
has one cell with a CID activated 
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External Short on 8X8 Matrix Pack 




Load: 10 mohms 
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Matrix Design Safety for Li-ion Cell Modules 

Summary 

Disconnection of any one cell in matrix design configuration packs has almost no 
influence on the performance of the packs and does not show any abnormal thermal 
changes for the 100 cycles obtained in this test program. Longer cycle life may 
influence the performance especially if the low voltage cell bank goes into reversal. 

Overcharge leads to CID activation of cells. If the matrix configuration has a larger 
number of cells in series, (more than 5S configuration) and had the PTCs, the limitations 
of protective devices may manifest itself irrespective of it being in a matrix configuration. 

External short circuit causes a fire with expulsion of content from some cells. The fire 
does not propagate itself laterally, but if there was cell module stacking, then the fire 
would cause the cells above it to also go into flames/thermal runaway. Limitations of 
protective devices are observed in this case as the PTCs in the cells did not protect 
under this abusive condition. 


Matrix configurations can provide protection against lateral propagation of fire and flame. 

Design needs to include safe internal construction such as proper insulation of wiring, 
insulation between rows of cells, proper wire routing (no excessive bending or cause for 
chafing or damage, etc.), no exposed metals between cell or module interconnects, etc. 
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Internal Short Hazard 

(Presented at NASA Battery Workshop 2008) 

Frank Zhao at 2007 IEEE PSES (Product Safety Engineering 
Society) Symposium presented the following data: 

Anode Film Cathode Film (<120° C) 

Anode Film Al Foil (thermal runaway) 

Cathode Film <-► Cu Foil (< 100 ° C) 

Al Foil <-► Cu Foil ( < 80 ° C) 

COTS Li-ion cells are produced in millions and if the quality 
control is not stringent, there is a higher possibility of getting 
internal cell shorts due to the presence of impurities such as 
metal particles, burrs, etc. 

NASA is more concerned about the impurities manifesting an 
internal short by dislodging and piercing the separator, 
during launch. 
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Causes for Internal Shorts 

Manufacturing defect - 

- manifests during assembly line or during the formation process (foreign 
object debris, lithium deposits, uneven electrode or separator during winding 
process; uneven wetting) 

- Manifests as latent defects during its calendar or cycle life 
Induced internal shorts in the field 

- Due to usage (charge/discharge cycling) and/or storage in extreme thermal 
environments (hot and cold) 

- Due to usage outside manufacturer’s voltage and current specifications 

- Due to high thermal gradients within a high voltage/high capacity pack 

- Due to dried out areas resulting from lack of accommodation of electrode 
swelling with inadequate cell designs 

Summary: High quality control of cells is necessary and usage should be 
within manufacturer’s specifications for all parameters. 
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Summary of all Safety Test Programs 
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Conclusions and Recommendations 


Determine, by testing, the PTC withstanding voltage and trip current for the 
cell to be used in battery design. Cells from different manufacturers will 
have different PTC ratings and this information is not provided in a cell 
specification. 

The cell PTC should not be compromised (activated or subjected to a 
condition that causes a rise in its resistance), if needed to be used as safety 
control. Cell screening for battery build for engineering, qualification as well 
as flight testing should not cause inadvertent activation of the PTC. Any 
cells in which the PTC may have been inadvertently tripped should not be 
used in the fabrication of flight batteries. 

The CID cannot always be depended upon as safety control in multicell 
series/parallel battery designs. To prevent cells from going into an 
overcharge condition, voltage monitoring should be implemented at a level 
that would allow reliable and accurate detection and prevention of an 
overcharge condition of even a single cell. 

Confirm that the CID safely activates and protects the battery from 
overcharge catastrophies in the actual flight battery configuration, if the CID 
is used as a level of safety control. Tests should be run at the module size 
that the CID is being used as a safety control. 
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Conclusions and Recommendations 


The charge current used to charge a string or a bank should be as low as 
possible. For charging of cell banks, the total charge current should be limited 
to a value that would not cause PTC activation in any single cell in the event that 
the CIDs of all the other cells have opened. 

In general, all electronic components have limitations -Environments can 
change their characteristics due to factors such as temperature gradients, 
distribution of current, imbalanced voltages, etc. which can make these devices 
ineffective 


The overdischarge test results indicate that several factors have to be taken into 
consideration while using cells in series and parallel configurations. 

- Cell matching should be stringent and based on capacity as well as internal resistance of the cells and not just the 
Open circuit voltage (Voltage versus capacity should be characterized for each cell design) 

- Cell modules should have an undervoltage cutoff to prevent cells from going into very low voltages especially if 
they are not stringently matched. 

- Have cell balancing to prevent one or more cells from being significantly imbalanced from the others. 

- Provide monitoring or it would be difficult to capture deep discharge or voltage reversal of one or more cells. 

Balancing during discharge may be more critical than during charge. 


J. Jeevarajan, Ph.D. / NASA-JSC 


48 


Conclusions and Recommendations 


The thermal environment is an important criteria - 

- Thermal signature of a large pack may indicate that there are huge gradients due to unbalanced 
internal resistances with cycle and calendar life which can in turn lead to overdischarge or 
overcharge due to imbalance as well as change the properties of protective devices. 

Modeling studies have shown that if the temperature is controlled to a reasonable 
value (below 55 °C was used in NASA-JSC studies), then the hazards do not 
manifest themselves into a thermal runaway condition. 

Tests have shown that for ease of monitoring and control, high voltage/ high 
capacity batteries are built with a P-S topology. However, the limitation of having 
too many in parallel should be understood. If there is a weak cell, all the current 
from the neighboring cells will feed into the weak cell. 

- 4 cells in parallel is maximum recommended design for medium-rate cell designs (provided the 
charge current is also controlled) based on available test data. 

- If more need to be paralleled, the limitations of the cell module needs to be determined and safety 
controls at the appropriate levels need to be incorporated. 

Use high quality cells with manufacturing control wherever possible. 

- Destructive Physical analysis and X-ray of sample cells of every new lot. X-ray of every cell that is 
used in a high capacity/ high voltage battery pack (field/flight unit) will be a benefit. 


Test as you fly - i.e., in the relevant environment 
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